sysop@hub:~/tools/intune-analyzer$

intune-analyzer

Drop the device list you export from Intune. You get one number for the health of the fleet, the devices behind every problem, what to do about each, and a command to pull the same list again later. The file is read by your browser and never uploaded, so it also works offline.

Drop the device export here, or click to choose a fileCSV from the Intune admin center, or JSON from Microsoft Graph

getting the export

Source	How
Intune admin center	Devices, All devices, Export. Choose to include all columns, not only the ones shown. The download is a zip with one CSV.
Microsoft Graph PowerShell	`Get-MgDeviceManagementManagedDevice -All \| ConvertTo-Json -Depth 3 \| Out-File devices.json` (needs DeviceManagementManagedDevices.Read.All)

what it checks

Check	Triggers when
Jailbroken or rooted	The device reports a jailbreak or root.
Mail-only devices	"Managed by" is Exchange ActiveSync only: the device syncs mail but gets no policy.
Non-compliant	Compliance state is Noncompliant. High when it is 10% of the fleet or more.
No compliance verdict	State is Not evaluated, Unknown, Error or similar. Usually no policy is assigned.
Grace period	The device fails a setting but still counts as compliant until the grace period ends.
No disk encryption	Encrypted is false. High when Windows or macOS computers are among them.
Windows out of servicing	The build belongs to a feature update whose servicing has ended, by edition: Home/Pro and Enterprise/Education have different dates. Without an edition column the later date is used. Long-term servicing builds are judged by their own dates.
Old major versions	iOS/iPadOS, macOS or Android devices two or more major versions behind the newest one found in your own fleet. Needs at least five devices of the platform.
Android patch level	Security patch level older than 90 days.
Stale devices	No check-in for more than 30 days, with a count of those over 90.
Duplicate records	Two or more records with the same serial number. Placeholder serials are ignored.
Personal devices	Ownership is Personal. Medium when Windows computers are among them.
No primary user	The primary user is empty.
Unsupervised Apple devices	Company-owned iPhones and iPads that are not supervised.
Low storage	Less than 10% of the storage is free.

"In good shape" means a device is compliant, encrypted, on a supported Windows version, seen in the last 30 days, not jailbroken and not mail-only. The export shows a state, not the reason: which compliance setting a device fails is only visible in Intune itself. Servicing dates for Windows are built into this page and were last reviewed in October 2026. If the newest check-in in the file is more than two weeks old, ages are measured from that day so an old export does not turn every device stale. Checks whose column is missing are listed as not checked.